Important information: this site is currently scheduled to go offline indefinitely by December 1st 2023.
If you wish to donate to attempt the preservation of tools and software somewhere else before it goes down, check the GoFundMe

Search found 7 matches

by tlvenn
Fri Jul 13, 2012 8:23 am
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

Re: SWTOR executable is now packed

Yeah figured that much :)

It's been a long time since I didnt mess up with PE. So I am guessing the next steps are to find the original OEP and from there, dump the process from OllyDump and reconstruct the IAT ?
Looks like it gonna be fun....
by tlvenn
Wed Jul 11, 2012 4:12 am
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

Re: SWTOR executable is now packed

Ok this is embarassing, I dont know how but I end up giving you an old version which is not packed yet at this point.... :eek:

Here is a link to the latest version which I believe is packed: https://dl.dropbox.com/u/45839385/retailclientV2.7z

Sorry about that.....
by tlvenn
Tue Jul 10, 2012 5:20 pm
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

Re: SWTOR executable is now packed

Thanks for the info Ekey !

Could you explain how you load properly the exe into IDA plz ? No matter what i try, I dont end up with the same result as yours...
Also, could you elaborate what you mean by "The exe is cleared not packed" ?

Thanks in advance !
by tlvenn
Tue Jul 10, 2012 3:11 am
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

Re: SWTOR executable is now packed

Ya I noticed the entry point there but even when telling Ida about the image base address, I end up with pretty much all text segments with no code (all grey instead of blue): > https://dl.dropbox.com/u/45839385/ida-swtor.png Steps I do : 1) Open the executable in Ida 2) In the options, I check &quo...
by tlvenn
Mon Jul 09, 2012 5:14 pm
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

Re: SWTOR executable is now packed

Weird, I included a zip as attachment to the message....

Sending you another msg with a link this time.
by tlvenn
Mon Jul 09, 2012 10:42 am
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

Re: SWTOR executable is now packed

Sent ! Thanks in advance..
by tlvenn
Mon Jul 09, 2012 4:39 am
Forum: Compressed files and methods
Topic: SWTOR executable is now packed
Replies: 15
Views: 4520

SWTOR executable is now packed

Since the 1.3 patch, the StarWars The Old Replublic client (swtor.exe) is now packed and cant be reversed out of the box. I was wondering if someone has started to work on it and could share some intel. I tried various PE tool to identify which packer they have used with no luck.

Thanks in advance.